{"id":"MAL-2026-13299","summary":"Malicious code in dolyame-boxy-component-story-name (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (8c0c190f59af98fd97bf6638398afd2a774dc07593d1d954b85fd150d7ce0c32)\nOn require() of this package, _support.js reconstructs Cloudflare Workers hostnames from split string fragments (e.g. 'oob-work'+'er.cf101-ad'+...+'workers.'+'dev'), fetches a platform-specific executable, with a DNS-TXT chunked fallback via '*.dl.wel1.ru' (also reconstructed from fragments like ['sdk','.dl.wel1','.r','u'].join('')), writes it to a hidden randomized filename under /tmp (or %TEMP%), sets mode 0755, and spawns it detached and orphaned via cp.spawn('/bin/sh', ['-c', fp+' &'], {detached:true}).unref(). Execution is gated by a TTL stamp file to run at most once per ~23000 seconds. A parallel dropper implementation ships in lib/telemetry.js with additional obfuscation (require('child_'+'process'), fs['chmod'+'Sync'], base64-assembled payload chunks) framed as an APM telemetry SDK. The package's stated purpose is a reusable component library, so the fetch-and-execute pipeline is entirely covert. The delivered bytes are attacker-controlled and opaque, yielding arbitrary code execution on the installer's host on import.\n","modified":"2026-08-05T16:50:41.017331913Z","published":"2026-08-05T15:26:05Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-015696","import_time":"2026-08-05T16:13:33.260395096Z","modified_time":"2026-08-05T15:26:05Z","sha256":"8c0c190f59af98fd97bf6638398afd2a774dc07593d1d954b85fd150d7ce0c32","source":"amazon-inspector","versions":["35.3.3"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/dolyame-boxy-component-story-name/v/35.3.3"}],"affected":[{"package":{"name":"dolyame-boxy-component-story-name","ecosystem":"npm","purl":"pkg:npm/dolyame-boxy-component-story-name"},"versions":["35.3.3"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"package_integrity":[{"filename":"dolyame-boxy-component-story-name-35.3.3.tgz","hashes":{"sha1":"0a787e5e7af0744a58968391d6dbd88e17f4f21b","sha512_sri":"sha512-9DMLT9HNxHX7IIeT5VSYLeRrHwdpJb/1A3k7i0UBhEmm0H1RLtJ5LkU+txFUlr/BCTxTpC37F6AMXcty9P4wRg=="}}],"evidence_files":[{"tlsh":"ffb1a69616aa70294f7097e0c61b8426f56ff66337c0c294f79ca9885f725288371dfc","path":"_support.js","sha256":"4cdcc970ed1547f9b2f35df459670912590eb8fcbc0627d5c2ffb66a802b8ffc"},{"path":"lib/telemetry.js","sha256":"de26336e36fae14d1112bc3215a40d876d70b2e8d89a13b9b55ee369cf61a5b6","tlsh":"84835056566a142186b2b378df234107ff3685272642429dbafc82dc1fbd72092a5ffc"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dolyame-boxy-component-story-name/MAL-2026-13299.json"}}],"schema_version":"1.8.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}